Cloud Native Virtual Machine Runtime Protection

2. The method of claim 1, wherein the normal behavior model is created based further on at least one behavioral rule, wherein each behavioral rule includes at least one of an explicitly allowed behavior for one of the one or more services, and an explicitly denied behavior for one of the one or more services.

3. The method of claim 1, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path.

6. The method of claim 5, wherein the uploaded normal behavior model is manually curated for use with respect to a common service executed by at least one other cloud native VM, wherein the common service is one of the one or more services.

7. The method of claim 1, wherein the capabilities of the one or more services comprises hierarchical structure indicating an identifier of the cloud native VM at a top level, an identifier of one of the one or more services at a sub-level, an identifier of a capability at a further sub-level, and a list of allowed behaviors at a further sub-level.

10. The machine-readable medium of claim 8, wherein the normal behavior model is created based further on at least one behavioral rule, wherein each behavioral rule includes at least one of an explicitly allowed behavior for the one or more services and an explicitly denied behavior for one of the one or more services.

11. The machine-readable medium of claim 8, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path.

13. The system of claim 9, wherein the normal behavior model is created based further on at least one behavioral rule, wherein each behavioral rule includes at least one of an explicitly allowed behavior for one of the one or more services and an explicitly denied behavior for one of the one or more services.

14. The system of claim 9, wherein the plurality of discrete behaviors includes at least one of running a process, using an input argument for a process, and accessing a file path.

17. The system of claim 16, wherein the uploaded normal behavior model is manually curated for use with respect to a common service executed by at least one other cloud native VM, wherein the common service is one of the one or more services.